Move hubot nginx sites to proxy role, deploy to fornax
This commit is contained in:
parent
6cce1d9df8
commit
65933bef4b
|
@ -33,6 +33,8 @@
|
|||
"kosmos_website::default",
|
||||
"kosmos-ejabberd::nginx",
|
||||
"kosmos-akkounts::nginx_api",
|
||||
"kosmos-hubot::nginx_botka_irc-libera-chat",
|
||||
"kosmos-hubot::nginx_hal8000_xmpp",
|
||||
"remotestorage_discourse::nginx",
|
||||
"kosmos_zerotier::controller",
|
||||
"kosmos_zerotier::firewall",
|
||||
|
|
|
@ -8,6 +8,8 @@ default_run_list = %w(
|
|||
kosmos_website::default
|
||||
kosmos-ejabberd::nginx
|
||||
kosmos-akkounts::nginx_api
|
||||
kosmos-hubot::nginx_botka_irc-libera-chat
|
||||
kosmos-hubot::nginx_hal8000_xmpp
|
||||
remotestorage_discourse::nginx
|
||||
)
|
||||
|
||||
|
|
|
@ -7,7 +7,6 @@ app_name = "botka_irc-libera-chat"
|
|||
app_path = "/opt/#{app_name}"
|
||||
app_user = "hubot"
|
||||
app_group = "hubot"
|
||||
domain = "irc-libera-chat.botka.kosmos.chat"
|
||||
|
||||
build_essential app_name do
|
||||
compile_time true
|
||||
|
@ -15,8 +14,9 @@ end
|
|||
|
||||
include_recipe 'redisio::default'
|
||||
include_recipe 'redisio::enable'
|
||||
include_recipe "kosmos-nodejs"
|
||||
include_recipe "kosmos-hubot::_user"
|
||||
include_recipe "kosmos-hubot::_nodejs"
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
application app_path do
|
||||
credentials = Chef::EncryptedDataBagItem.load('credentials', app_name)
|
||||
|
@ -99,27 +99,9 @@ application app_path do
|
|||
end
|
||||
end
|
||||
|
||||
#
|
||||
# Nginx reverse proxy
|
||||
#
|
||||
unless node.chef_environment == "development"
|
||||
include_recipe "kosmos-base::letsencrypt"
|
||||
include_recipe "kosmos-nginx"
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
|
||||
source 'nginx_conf_hubot.erb'
|
||||
owner node["nginx"]["user"]
|
||||
mode 0640
|
||||
variables express_port: node[app_name]['http_port'],
|
||||
server_name: domain,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
|
||||
notifies :reload, 'service[nginx]', :delayed
|
||||
end
|
||||
|
||||
nginx_site domain do
|
||||
action :enable
|
||||
end
|
||||
|
||||
nginx_certbot_site domain
|
||||
firewall_rule app_name do
|
||||
port node[app_name]['http_port']
|
||||
source "10.1.1.0/24"
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
|
|
|
@ -0,0 +1,24 @@
|
|||
include_recipe "kosmos-base::letsencrypt"
|
||||
include_recipe "kosmos-nginx"
|
||||
|
||||
domain = "irc-libera-chat.botka.kosmos.chat"
|
||||
|
||||
nginx_certbot_site domain
|
||||
|
||||
upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
|
||||
source 'nginx_conf_hubot.erb'
|
||||
owner node["nginx"]["user"]
|
||||
mode 0640
|
||||
variables express_port: node['botka_irc-libera-chat']['http_port'],
|
||||
server_name: domain,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
|
||||
upstream_host: upstream_host
|
||||
notifies :reload, 'service[nginx]', :delayed
|
||||
end
|
||||
|
||||
nginx_site domain do
|
||||
action :enable
|
||||
end
|
|
@ -0,0 +1,24 @@
|
|||
include_recipe "kosmos-base::letsencrypt"
|
||||
include_recipe "kosmos-nginx"
|
||||
|
||||
app_name = "hal8000_xmpp"
|
||||
|
||||
nginx_certbot_site node[app_name]['domain']
|
||||
|
||||
upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/#{node[app_name]['domain']}" do
|
||||
source 'nginx_conf_hubot.erb'
|
||||
owner node["nginx"]["user"]
|
||||
mode 0640
|
||||
variables express_port: node[app_name]['http_port'],
|
||||
server_name: node[app_name]['domain'],
|
||||
ssl_cert: "/etc/letsencrypt/live/#{node[app_name]['domain']}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{node[app_name]['domain']}/privkey.pem",
|
||||
upstream_host: upstream_host
|
||||
notifies :reload, 'service[nginx]', :delayed
|
||||
end
|
||||
|
||||
nginx_site node[app_name]['domain'] do
|
||||
action :enable
|
||||
end
|
|
@ -2,10 +2,9 @@
|
|||
# Generated by Chef
|
||||
#
|
||||
upstream _express_<%= @server_name.gsub(".", "_") %> {
|
||||
server localhost:<%= @express_port %>;
|
||||
server <%= @upstream_host || "localhost" %>:<%= @express_port %>;
|
||||
}
|
||||
|
||||
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name <%= @server_name %>;
|
||||
|
@ -26,4 +25,3 @@ server {
|
|||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
}
|
||||
<% end -%>
|
||||
|
|
Loading…
Reference in New Issue